blankgrabber | 139eb083018ab4999e73c5cd52a3f6d744e4900344abf2047eb5d71957d4a5e9

General

Target
2026-07-08_fa3b4cceb03682b3eaf07131a4632a82_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 14.5MB
Sample260708-cf2b3ahz7n
SHA256 139eb083018ab4999e73c5cd52a3f6d744e4900344abf2047eb5d71957d4a5e9
MD5 fa3b4cceb03682b3eaf07131a4632a82
SHA1 9a0c8ec332781b858e3205a21a2e566d6d8fff44
SHA512 0251bdb66ff79b2ffce2987a467d6fe1028f3190071588e99b66b4e9f1b77b2e086f1fd581ef9752e0d1bb35c4e8468c09edcb68e9eb23e8e26578b06b2527c5
SSDEEP 196608:MF5ADz+bGnyacoSAeAxxk7SRtk948OuHsntMNkIahjyRumY4KR0Dgp3AtRgEvoKy:MF2Wwb27Sop5QmWRgtRLvF7XLpQn
TLSH
T170E6331436C446A7EAE3653E4D53C61AFEE178218B6096DF435853A43F1F8A0C93E3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_fa3b4cceb03682b3eaf07131a4632a82_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 14.5MB
- SHA256 139eb083018ab4999e73c5cd52a3f6d744e4900344abf2047eb5d71957d4a5e9
- MD5 fa3b4cceb03682b3eaf07131a4632a82
- SHA1 9a0c8ec332781b858e3205a21a2e566d6d8fff44
- SHA512 0251bdb66ff79b2ffce2987a467d6fe1028f3190071588e99b66b4e9f1b77b2e086f1fd581ef9752e0d1bb35c4e8468c09edcb68e9eb23e8e26578b06b2527c5
- SSDEEP 196608:MF5ADz+bGnyacoSAeAxxk7SRtk948OuHsntMNkIahjyRumY4KR0Dgp3AtRgEvoKy:MF2Wwb27Sop5QmWRgtRLvF7XLpQn
- TLSH
  T170E6331436C446A7EAE3653E4D53C61AFEE178218B6096DF435853A43F1F8A0C93E3B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3

T1059

PowerShell

2

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Deletes Windows Defender Definitions

UPX dump on OEP (original entry point)

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Disables one or more Microsoft Defender components

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2